# Native validation

**Incomplete native rebuild; not full PWA parity and not production-ready.**
The old browser results are [historical only](legacy-wrapper-validation.md).

The new shipping surfaces are Android Compose and iOS SwiftUI. Current native
tests are in `androidTestNative` / `androidTestNativeIntegration`, JVM native policy
tests, and Swift production contracts/transport tests. Archived WebView tests are
not included in the native suites or counted toward native completion.

## Android 0.2.1 / code 3: reproduced login regression

The user reported immediate login failure despite a working direct browser login.
The root cause was reproduced using upstream's `SESSION_SECURE=false` default over
HTTPS: browser/protocol login succeeded, but the old Android jar discarded the
session cookie and its next authenticated API request failed. The fixed jar binds
all cookies to HTTPS itself instead of requiring this optional server attribute.
HTTP, cross-origin requests/redirects, invalid certificates, plaintext persistence
and session-only cookie persistence remain disallowed.

- Before-fix failure retained in `/home/neste/yuvomi-login-cookie-before.log` and
  `/home/neste/yuvomi-login-cookie-before.xml` (synthetic fixture only).
- After-fix upstream-default cookie mode: 7 instrumentation tests passed,
  zero failures/skips; complete harness exited successfully.
- Secure-cookie mode: the same 7 tests passed, zero failures/skips.
- Both modes test a rejected password followed by successful retry with no stale
  error, native dashboard/recreation, task/note/shopping calls and logout.
- 13 JVM tests passed, including default-cookie persistence/deletion, expired/empty
  session detection and separate credential/2FA/session-handoff error messages.
- Both lint variants, debug/unsigned release APK/AAB builds and the 6-test ordinary
  native UI suite passed. Its first attempt hit a leftover CI-debug certificate
  mismatch and produced zero tests; the verifier correctly rejected it. After
  confirming the fixture package was absent, the rerun executed all 6 with no
  failures/skips (`/home/neste/yuvomi-login-debug-retry.log`).
- Logs: `/home/neste/yuvomi-login-cookie-after.log`,
  `/home/neste/yuvomi-login-secure-after.log`, `/home/neste/yuvomi-login-unit.log`,
  `/home/neste/yuvomi-login-validation.log`.
- Gitea run #11/global 666, build job 1071 at `4b483c2`: packages, JVM/lint,
  repository/script/format checks, OSV and artifact uploads all succeeded.
- [Download fixed Android 0.2.1/code 3](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/666/artifacts/android-native-debug-apk).
  The ZIP was downloaded and its sole APK version/v2 signature checked; it was
  installed and launched on the authorized local emulator. APK SHA-256:
  `a769118f0bd16988f76a8ee95c0aa0c5e248104e8ea529eee2e0c83d78b6ca5a`.
  This does not certify the still-blocked remote emulator matrix or Apple pipeline.

See [login troubleshooting](login-troubleshooting.md). This reproduces a matching
compatibility defect without accessing the user's server or credentials; it does
not claim inspection of that particular server's configuration.

## Initial 0.2.0 preview evidence — 2026-10-21

| Check | Observed result |
| --- | --- |
| Android JVM tests | 10 passed; zero failed/skipped |
| Native Compose UI/security suite, API 35 emulator | 6 passed; zero failed/skipped |
| Real-upstream native integration suite | 7 passed; zero failed/skipped (the same 6 onboarding tests plus 1 multi-step real-server scenario) |
| Native scenario | Login/dashboard, activity recreation, task/note/list/item creation and API readback, redirect refusal, logout and vault erasure |
| Integration screenshot export | Successful AGP test-output collection; native dashboard PNG opened and visually confirmed nonblank, synthetic data only |
| Android lint | Debug and release passed; newer-version recommendations remain informational |
| Android packages | Debug APK and unsigned release APK/AAB built successfully |
| Swift portable suite | 16 passed; actual Foundation transport/contracts and URL/metadata policy, not Apple UI/Keychain execution |
| Swift formatting/parsing | Strict format lint and parsing passed, including Apple-only sources |
| Script regressions | 14 runner-preflight/Apple-probe, 8 JUnit-evidence and 5 screenshot-output tests passed |
| Repository/workflows | Source invariants, Python compilation, diff whitespace and actionlint for all 3 Gitea workflows passed |
| OSV | No listed advisories for 266 locked/direct Maven coordinates and plugins; not a security audit |

Environment: Linux/WSL, OpenJDK 17.0.20.1, Gradle 9.6.0, AGP 9.4.1,
Kotlin/Compose compiler 2.4.21, API 35 `sdk_gphone64_x86_64` emulator, Swift 6.2.1.
The host-only Tink upgrade to 1.15.0 removes the observed obsolete generated
protobuf warning; the final Android validation log has no such warning.

The first integration attempt missed the scrolled-off login button. Later,
post-uninstall screenshot retrieval failed, and the first compositor capture was
black. The final test scrolls the real button, uses native-window capture with a
nonblank-pixel assertion and writes through `PlatformTestStorageRegistry` for AGP
collection. The latest complete harness exits successfully, not just its JUnit
subprocess. Ordinary builds retain screenshot protection.

The unmodified pinned upstream HTTPS/OIDC protocol fixture also passed TLS trust,
metadata, cookies, CSRF and remote revocation checks. Its IdP exchange is **not
native SSO**: the native client refuses the redirect and SSO remains pending.

Evidence paths in the local external build directory:

- `app/test-results/testDebugUnitTest/`
- `app/outputs/androidTest-results/connected/{debug,integration}/`
- `app/outputs/native-screenshots/native-dashboard.png`
- `app/reports/lint-results-{debug,release}.html`
- Logs: `/home/neste/yuvomi-native-validation.log`,
  `/home/neste/yuvomi-native-integration-final.log`,
  `/home/neste/yuvomi-native-swift.log`.

## Observed Gitea results for source `40a7962`

- Android run #5 (global run 660), build job 1059: **success**, including packages,
  JVM/lint, formatting/repository/script checks, OSV and both artifact uploads.
- The actual `android-native-debug-apk` ZIP was downloaded. It contains exactly
  `app-debug.apk`, version `0.2.0-native-preview`/code 2; APK v2 signature verified,
  no fixture certificate/private-key files, installed and launched on the local
  authorized API-35 emulator. SHA-256 of the downloaded APK:
  `48d58ba5663b2e4fe563064efc567732e8ea35588cb610660f60406e82ccf610`.
  Its ephemeral CI debug certificate differs from the local development key, so
  its checksum intentionally differs from the locally collected APK.
- [Download the verified native debug artifact](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/660/artifacts/android-native-debug-apk)
  (repository access required; normal 14-day artifact retention applies).
- Remote jobs 1060/1061 (API 35/37.0): **failed preflight** because `/dev/kvm` was
  not exposed/writable. They executed no emulator tests. The matrix is not green.
- iOS run #6 (global 661), job 1062: verified native Node bootstrap and checkout
  **succeeded**. Xcode 27.1/build 27A9275 printed, but the subsequent Apple-tool
  preflight did not return during a 20-minute observation. No SwiftUI compile or
  simulator/XCTest/Keychain/device success is claimed. Bounded, named tool probes
  now fail with actionable diagnostics instead of silently hanging for the job's
  full hour.
- Follow-up iOS run #8 (global 663), job 1066 at `92dbd0e`: Node, checkout,
  `xcodebuild -version` and `xcrun --find swift` passed. The exact blocker is
  **`xcrun simctl list devices available`**, which exceeded its 60-second deadline.
  Preflight correctly failed; application builds/tests/archive were skipped, not
  passed. The runner administrator must repair CoreSimulator availability for the
  runner user before Apple application validation can proceed.

No Apple SDK application build, simulator UI test or physical-device result is
claimed from the Linux runs or the stalled Mac job. Runner prerequisites were
not weakened or counted as passing, and no host license/settings were changed.

## Commands

```sh
bash android/gradlew -p android testDebugUnitTest lintDebug lintRelease assembleDebug assembleRelease bundleRelease connectedDebugAndroidTest
python3 scripts/test-integration.py /path/to/pinned-upstream --android
swift test --package-path ios
swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift
python3 scripts/check-repository.py
python3 scripts/check-dependencies.py
python3 scripts/lint-workflows.py /path/to/actionlint
```

On the local WSL checkout use `YUVOMI_BUILD_DIR=/home/neste/yuvomi-native-build`
and the SDK paths from [continuation](continuation.md). Select only the authorized
test emulator with `ANDROID_SERIAL=emulator-5554`; unrelated/unauthorized attached
devices are not test targets.

## External gates

Apple SDK builds, real supported devices/current engines, Android API 37, native
SSO/reset/invite protocols, permission/role cases, files/offline/notifications,
complete module and settings parity, visual baselines, accessibility and human
security review remain open. Missing modules are listed in
[native parity](native-parity.md), not silently represented as working.